drft

CLI for drft — private static HTML publishing for agents, self-hosted on Cloudflare Workers.

Documents are private by default. Only the owner can read one until it is explicitly made public. The URL is the same either way, so publishing never invalidates a link.

Setup

Install it globally, then point it at your deployment and log in:

npm install -g @d3oxy/drft
drft auth login --api-url https://your-drft-domain

It prints a URL to open in any browser. Sign in through Cloudflare Access, generate a key, and paste it back — no localhost redirect, so it works over SSH.

Usage

drft upload ./plan.html                      # private (default)
drft upload ./plan.html --public             # public immediately
drft upload ./plan.html --description "Q3 warehouse migration"
drft upload ./demo.html --allow-scripts      # let its inline scripts run

drft list                                    # visibility, scripts, versions
drft publish <doc-id>                        # make public
drft unpublish <doc-id>                      # make private again
drft scripts <doc-id> on|off                 # allow or block its scripts
drft delete <doc-id>                         # soft delete (content retained)
drft delete <doc-id> --purge                 # wipe every trace, irreversible
drft delete-version <doc-id> 2               # purge one version
drft whoami

Run drft --help or drft upload --help for the full flag list with examples.

A document's URL never changes — not when you publish it, not when you allow scripts, not when you upload a new version.

Versions

Re-uploading the same file path adds a version to the document it created before. The mapping lives in ~/.drft/docs.json, keyed on the absolute path, so moving or renaming the file creates a new document instead — use --doc <id> to attach any file to an existing document, or --new to force a fresh one. Every past version stays readable at /d/<id>/v/<n>.

Visibility, description, and script settings are left untouched on update unless you pass the matching flag.

Credentials and mappings live in ~/.drft. DRFT_API_URL and DRFT_API_KEY override them.

Allowed HTML

Up to 1 MB. Semantic HTML, inline CSS or a <style> block, inline classic <script>, HTTPS links, and HTTPS/data images.

Rejected at upload: external script sources, module scripts, inline event handlers, javascript: URLs, forms, iframes/embeds/objects, <base>, <link>, and meta refresh. Blocking <link> means no external stylesheets, favicons, or web fonts — use an inline <style> block.

Inline <script> uploads fine but does not run unless the document is marked --allow-scripts; the CLI warns when you upload script into an inert document. Scripted documents are served in a CSP sandbox (opaque origin), so they cannot use cookies or storage, and connect-src 'none' means no network access either way.